This invention relates generally to computer security software, and more particularly to configuring a firewall on a client for an application using reputation information and firewall configuration of other existing clients.
Private networks, such as those operated by businesses or other enterprises, are often connected a public network such as the Internet. The private networks typically include a firewall positioned at the intersection of the private and public networks. The firewall monitors traffic passing between the networks and blocks unauthorized and/or malicious traffic. The firewall thus prevents malicious entities on the public network from accessing the resources of the private network, and prevents entities on the private network from accessing unauthorized resources of the public network.
A more recent trend in network security is to run so-called “personal firewalls” on the computer systems used by the end-users to access the network. For example, the desktop computer utilized by an employee of an enterprise can run a personal firewall. The personal firewall monitors network activity to/from the computer and blocks malicious traffic.
An advantage of a personal firewall is that it can apply a different security policy to each process executing on the computer. When a personal firewall is first installed on a computer, the personal firewall typically detects each attempt by a process to access the network. With each attempt, the firewall presents a dialog box to the end user, saying something to the effect of: “Process X has attempted to access the Internet. Allow it to proceed?” The end-user responds to the dialog box by indicating whether the firewall should allow or block the network access. The personal firewall remembers the end-user's choices and applies the same security policy next time the process attempts to access the network.
A problem with relying on end users to establish security policies is that the end users are often not sophisticated enough to evaluate the security threat posed by a given process. A typical end user might not have any idea whether a process should be allowed to access the network. Some personal firewalls attempt to solve this problem by including additional information in the dialog box, such as the destination address and/or protocol of the access request. However, this additional information often serves to confuse the end user further. Another problem with this approach is that the personal firewall will remember and continue to apply the end user's decision, even if it was incorrect.
A security vendor may create firewall rules, which may apply to particular applications, using either or both automatic and manual processes. These firewall rules are then part of the stock configuration of the security vendor's firewall product. But whether the rules are generated automatically by the software or manually by a user, the rules may be too permissive or too restrictive. As a result, applications running on the user's client system may be wrongly allowed or wrongly denied to communicate over the network.